NetBIOS Enumeration on Port 139 for CEH

312-50v12 By islever Editorial Last updated

Enumeration

Short answer

B Exploit the NetBIOS Session Service on TCP port 139 to gain unauthorized access to the file system

Question

As a certified ethical hacker, you are tasked with gaining information about an enterprise's internal network. You are permitted to test the network's security using enumeration techniques. You successfully obtain a list of usernames using email IDs and execute a DNS Zone Transfer. Which enumeration technique would be most effective for your next move given that you have identified open TCP ports 25 (SMTP) and 139 (NetBIOS Session Service)?
  1. Perform a brute force attack on Microsoft Active Directory to extract valid usernames
  2. Exploit the NetBIOS Session Service on TCP port 139 to gain unauthorized access to the file system Correct Answer
  3. Use SNMP to extract usernames given the community strings
  4. Exploit the NFS protocol on TCP port 2049 to gain control over a remote system

Key Takeaways

The question tests the prioritization of enumeration steps based on identified services, with a common trap being the confusion between exploitation and data extraction.

This question evaluates the correct enumeration technique following the discovery of open TCP ports 25 and 139. The correct answer leverages NetBIOS Session Service to extract sensitive network information.

Common mistake: Many candidates choose Option A (Brute force Active Directory) because they overlook that valid usernames were already obtained via DNS Zone Transfer, making brute force redundant.

Expert Analysis

Why the Answer Is Correct

Option B is the correct choice because port 139 indicates the NetBIOS Session Service is active. In the CEH methodology, NetBIOS enumeration is a primary step after identifying open ports, as it allows the extraction of a large amount of sensitive information including user lists, machine names, and shared resources without necessarily launching an attack immediately.

Why the Other Options Are Wrong

Option A is incorrect because the scenario states that usernames have already been successfully obtained via email IDs and DNS Zone Transfer; therefore, brute-forcing AD for usernames is redundant. Option C is wrong because SNMP typically runs on UDP ports 161/162, not TCP 139 or 25. Option D is invalid because NFS uses port 2049, which was not identified as open in the scenario.

Community Comment Notes

Community discussion highlights a conflict between "exploit" and "enumerate." As insaniunt noted, "the question asking for 'Which enumeration technique', not about perform attack or exploit something," suggesting that extracting data via NetBIOS fits the definition better than a full breach. Others like duke_of_kamulu reference CEH v12 page 403-404, emphasizing the systematic flow where NetBIOS enumeration precedes other steps when specific ports are identified.

Exam Strategy

Always cross-reference identified ports with their standard services before selecting an option. If the question asks for enumeration, prioritize techniques that gather information (like NetBIOS queries) over those that directly compromise access, unless the service itself is the target for immediate exploitation.

Frequently Asked Questions

Why is brute force (A) incorrect if usernames are known?

Since the scenario states usernames were already obtained via DNS Zone Transfer, brute-forcing AD is redundant. The next logical step is to use the known service (NetBIOS) to gather more details.

Does NetBIOS enumeration count as an attack?

In the context of this exam question, leveraging NetBIOS to extract shares and users is classified as an enumeration technique aimed at gathering intelligence rather than a destructive exploit.

More 312-50v12 FAQ →

Community Votes

B
59%
C
41%

59% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 14 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 14

  1. przemyslaw1 👍 11 Answered B
    B. Exploit the NetBIOS SNMP uses UDP ports 161 and 162
  2. insaniunt 👍 3 Answered C
    just pay attention, the question asking for "Which enumeration technique", not about perform attack or exploit something
  3. sosindi 👍 2
    A, We already extracted emails usernames- "successfully obtained a list of usernames using email IDs and execute a DNS Zone Transfer" the next would be A now to exploit netbios.
  4. duke_of_kamulu 👍 2
    GUYS AGAIN i repeat answers is C go to page 403,404 and check you will find its clear the steps they are six
  5. Spam_Protection 👍 1 Answered A
    You need to validate your usernames. You can do this brute forcing Active Directory. Module 4: Techniques for Enumeration section - ▪ Brute force Active Directory Microsoft Active Directory is susceptible to username enumeration at the time of user-supplied input verification. This is a design error in the Microsoft Active Directory implementation. If a user enables the “logon hours” feature, then all the attempts at service authentication result in different error messages. Attackers take advantage of this to enumerate valid usernames. An attacker who succeeds in extracting valid usernames can conduct a brute-force attack to crack the respective passwords.
Show 9 more comments
  1. agelbahri 👍 1 Answered B
    CEH v12 page : 411 NetBIOS is considered first for enumeration because it extracts a large amount of sensitive information about the target network, such as users and network shares.
  2. duke_of_kamulu 👍 1
    according to CEHv12 they follow systematic flow shown clearly on the table pg 403 1-6 so C get Techniques for Enumeration step six last step is Extract usernames using SNMP
  3. JustAName 👍 1 Answered C
    I'd choose C because exploitation and brute force attacks are typically considered post-enumeration activities and consider too invasive to be "enumeration" activity
  4. noyon2002 👍 1
    A Brute force active directory, it is the 3rd step in techniques for enumeration : CEH V12 Module 4 Page 403
  5. 49f4430 👍 1 Answered A
    A Nothing about 161 and 162, B is a attack..that leave us with A :validate the usernames
  6. Rafael_Fontana 👍 1 Answered B
    You already have usernames so.... Am I missing something?
  7. cloudgangster 👍 3 Answered C
    c, check ceh v12 pg 403
  8. jrbobson 👍 1 Answered C
    Enumeration is the key - C
  9. pranav10 👍 1 Answered C
    CEHv12 page number 404

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide